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IN THE CLAIMS: 


Amended claims follow: 


1.-31. (Cancelled) 

32. (Currently Amended) A method for reporting on the collection of network usage 
information from a plurality of network devices, comprising: 

(a) collecting network communications usage information in real-time from a plurality of 
network devices at a plurality of layers utilizing multiple gatherers each including a plurality 
of information source modules each interfacing with one of the network devices and capable 
of communicating using a protocol specific to the network device coupled thereto, the 
network devices selected from the group consisting of routers, switches, firewalls, 
authentication servers, web hosts, proxy servers, netflow servers, databases, mail servers. 
RADIUS servers, and domain name servers, the gatherers being positioned on a segment of 
the network on which the network devices coupled thereto are positioned for minimizing an 
impact of the gatherers on the network : 

(b) filtering and aggregating the network communications usage information; 

(c) completing a plurality of data records from the filtered and aggregated network 
communications usage information, the plurality of data records corresponding to network 
usage by a plurality of users; 

(d) storing the plurality of data records in a database; 

(e) allowing the selection of one of a plurality of reports for reporting purposes; 

(f) submitting queries to the database utilizing the selected reports for retrieving information on 
the collection of the network usage information from the network devices; and 

(g) outputting a report based on the queries. 
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33. (Original) A method as recited in claim 32, and further comprising submitting 
network activity queries to the database utilizing the selected reports for retrieving information on 
activity of the network. 

34. (Original) A method as recited in claim 33, and further comprising outputting a 
network activity report based on the network activity queries. 

35. (Original) A method as recited in claim 32, and further comprising submitting 
resource consumption queries to the database utilizing the selected reports for retrieving information 
on resource consumption in the network. 

36. (Original) A method as recited in claim 33, and further comprising outputting a 
resource consumption report based on the resource consumption queries. 

37. (Original) A method as recited in claim 33, and further comprising generating an alert 
upon the occurrence of an event. 

38. (Original) A method as recited in claim 37, wherein the alert is generated upon a 
value surpassing a predetermined amount. 

39. (Original) A method as recited in claim 37, wherein the alert indicates that services 
should be ceased. 

40. (Original) A method as recited in claim 37, wherein the alert indicates that services 
should be provided. 

41 . (Original) A method as recited in claim 32, wherein the report includes an auditing 

report. 

42. (Original) A method as recited in claim 32, wherein the report includes a billing 

report. 
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43. (Original) A method as recited in claim 32, wherein the report includes an accounting 

report, 

44. (Currently Amended) A computer program product for reporting on the collection of 
network usage information from a plurality of network devices, comprising: 

(a) computer code for collecting network communications usage information in real-time from a 
plurality of network devices at a plurality of layers utilizing multiple g atherers each including 
a plurality of information source modules each int e rfacing with one of the network devices 

\ and capable of communicating using a pro to col specific to the network device coupled 

N ^ thereto, the network devices selected from the grou p consisting of routers, switches, 

firewalls, authentication servers, web hosts, proxy server s, netflow servers, databases, mail 
servers. RADIUS servers, and domain name servers, the gatherers being positioned on a 
segment of the network on which the network devices coupled the reto are positioned for 
minimizing an impact of the gatherers on the network ; 

(b) computer code for filtering and aggregating the network communications usage information; 

(c) computer code for completing a plurality of data records from the filtered and aggregated 
network communications usage information, the plurality of data records corresponding to 

" network usage by a plurality of users; 

(d) computer code for storing the plurality of data records in a database; 

(e) computer code for allowing the selection of one of a plurality of reports for reporting 
purposes; 

(f) computer code for submitting queries to the database utilizing the selected reports for 
retrieving information on the collection of the network usage information from the network 
devices; and 

(g) computer code for outputting a report based on the queries. 

45. (Currently Amended) A system for reporting on the collection of network usage 
information from a plurality of network devices, comprising: 

(a) information source modules for collecting network communications usage information in 
real-time from a plurality of network devices at a plurality of layers utilizing multiple 
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gatherers each including a plurality of informati on source modules each interfacing with on* 
o f the network devices and capable of commi. n icating using a protocol sp ecfiV. to th P 
network device coupled thereto, the network devi ces selected from the group mr.^tinp .f 
routers, switches, firewalls, authentication serv ^ , web hosts. P m xv servers, netflow sen,™ 
databases, mail servers. RADIUS servers, and domain name servers, the gatherers being 
positioned on a segment of the network o n which the network devir.es coupled thereto an* 
positioned for minim izing an impact of the gatherers on the network : 

(b) gatherers coupled to the information source modules, the gatherers adapted foT filtering and 
aggregating the network communications usage information; 

(c) a central event manager coupled to the gatherers, the central event manager adapted for 
\ \ completing a plurality of data records from the filtered and aggregated network 

communications usage information, the plurality of data records corresponding to network 
usage by a plurality of users; 

(d) a database coupled to the central event manager, the database adapted for storing the plurality 
of data records; and 

(e) logic for allowing the selection of one of a plurality of reports for reporting purposes, 
submitting queries to the database utilizing the selected reports for retrieving information on 
the collection of the network usage information from the network devices, and outputting a 
report based on the queries. 

46. (Original) A method for reporting on the collection of network usage information 
from a plurality of network devices, comprising: 

(a) collecting network communications usage information in real-time from network devices at a 
plurality of layers utilizing multiple gatherers each including a plurality of information source 
modules each interfacing with one of the network devices and capable of communicating 
using a protocol specific to the network device coupled thereto, the network devices selected 
from the group consisting of routers, switches, firewalls, authentication servers, web hosts, 
proxy servers, netflow servers, databases, mail servers, RADIUS servers, and domain name 
servers, the gatherers being positioned on a segment of the network on which the network 
devices coupled thereto are positioned for minimizing an impact of the gatherers on the 
network; 
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(b) translating the network communications usage information collected from the network 
devices utilizing the information source modules; 

(c) caching the network communications usage information collected from the network devices 
utilizing the gatherers; 

(d) normalizing the network communications usage information with the gatherers by excluding 
fields not required by a central event manager coupled to the gatherers; 

(e) defining an enhancement procedure utilizing the central event manager; 

(f) coordinating the collection of the network communications usage information by the 
gatherers utilizing the central event manager, 

(g) filtering the network communications usage information utilizing the central event manager; 

(h) completing a plurality of data records from the filtered network communications usage 
information, the plurality of data records corresponding to network usage by a plurality of 
users; 

(i) aggregating the network communications usage information and the data records utilizing the 
central event manager for reducing a number of the data records; 

(j) enhancing the aggregation of the network communications usage information with the 

gatherers in accordance with the defined enhancement procedure; 
(k) time stamping the data records; 

(1) storing the time stamped data records in tables in a central database coupled to the central 

event manager at a user-specified interval; 
(m) deleting the stored data records upon the cessation of a predetermined amount of time after 

the storage utilizing the timestamp; 
(n) periodically determining whether the network devices are currently licensed; 
(o) submitting network activity queries to the central database for retrieving information on 

activity of the network; 
(p) outputting a network activity report based on the network activity queries; 
(q) submitting resource consumption queries to the central database for retrieving information on 

resource consumption in the network; 
(r) outputting a resource consumption report based on the resource consumption queries; and 
(s) generating an alert upon the occurrence of an event utilizing the information source modules. 
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47. (Original) A method as recited in claim 46, wherein the alert is generated upon a 
value surpassing a predetermined amount. 

48. (Original) A method as recited in claim 46, wherein the alert indicates that services 
should be ceased. 



49. (Original) A method as recited in claim 46, wherein the alert indicates that services 
should be provided. 
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